From b6f0d5c126391028abdae0a671c73e6be801a154 Mon Sep 17 00:00:00 2001 From: Alfred Date: Wed, 26 Aug 2026 04:21:02 +0000 Subject: [PATCH] fix(ci): lowercase GHCR image name for buildx tag validation Docker/GHCR require lowercase repository names. github.repository (SabaTech-dev/Alfred-Mission-Control) broke 'docker buildx build' with 'invalid tag: repository name must be lowercase', failing the SLSA Build & Attest job on every push to main. Introduce workflow-level env.IMAGE_NAME (canonical lowercase artifact name) and use it consistently for: build tags, attestation subject-name and the verification summary (which also referenced a never-pushed 'sha-' prefixed tag). --- .github/workflows/slsa-provenance.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/slsa-provenance.yml b/.github/workflows/slsa-provenance.yml index 5733050b..1876b604 100644 --- a/.github/workflows/slsa-provenance.yml +++ b/.github/workflows/slsa-provenance.yml @@ -22,6 +22,12 @@ concurrency: group: slsa-${{ github.ref }} cancel-in-progress: true +# GHCR/Docker exigen repositorios en lowercase; github.repository contiene +# mayúsculas (SabaTech-dev/Alfred-Mission-Control) y buildx rechaza el tag. +# Nombre canónico fijo del artefacto — usar SIEMPRE env.IMAGE_NAME. +env: + IMAGE_NAME: ghcr.io/sabatech-dev/alfred-mission-control + jobs: provenance: name: Build & Attest @@ -48,14 +54,14 @@ jobs: with: context: . push: true - tags: ghcr.io/${{ github.repository }}:${{ github.sha }} + tags: ${{ env.IMAGE_NAME }}:${{ github.sha }} provenance: true sbom: true - name: Generate build provenance attestation uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c with: - subject-name: ghcr.io/${{ github.repository }} + subject-name: ${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true @@ -73,5 +79,5 @@ jobs: echo "" >> $GITHUB_STEP_SUMMARY echo "**Verification command:**" >> $GITHUB_STEP_SUMMARY echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "docker buildx imagetools inspect ghcr.io/${{ github.repository }}:sha-${{ github.sha }}" >> $GITHUB_STEP_SUMMARY + echo "docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ github.sha }}" >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY